aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/ndpi_main.c24
-rw-r--r--src/lib/protocols/ftp_data.c8
-rw-r--r--tests/cfgs/default/pcap/shell.pcapbin0 -> 13734 bytes
-rw-r--r--tests/cfgs/default/result/shell.pcap.out35
4 files changed, 59 insertions, 8 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 06c609606..9bb5010fd 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -8160,6 +8160,29 @@ static int ndpi_is_ntop_protocol(ndpi_protocol *ret) {
/* ********************************************************************************* */
+static void ndpi_search_shellscript(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search Shellscript\n");
+
+ if (packet->payload_packet_len < 3)
+ {
+ return;
+ }
+
+ if (packet->payload[0] != '#' ||
+ packet->payload[1] != '!' ||
+ (packet->payload[2] != '/' && packet->payload[2] != ' '))
+ {
+ return;
+ }
+
+ NDPI_LOG_INFO(ndpi_struct, "found Shellscript\n");
+ ndpi_set_risk(flow, NDPI_POSSIBLE_EXPLOIT, "Shellscript found");
+}
+
/* ELF format specs: https://man7.org/linux/man-pages/man5/elf.5.html */
static void ndpi_search_elf(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow)
@@ -8622,6 +8645,7 @@ static ndpi_protocol ndpi_internal_detection_process_packet(struct ndpi_detectio
{
ndpi_search_portable_executable(ndpi_str, flow);
ndpi_search_elf(ndpi_str, flow);
+ ndpi_search_shellscript(ndpi_str, flow);
}
if(flow->first_pkt_fully_encrypted == 0 &&
diff --git a/src/lib/protocols/ftp_data.c b/src/lib/protocols/ftp_data.c
index 048097156..1b5d42ffd 100644
--- a/src/lib/protocols/ftp_data.c
+++ b/src/lib/protocols/ftp_data.c
@@ -82,10 +82,6 @@ static int ndpi_match_file_header(struct ndpi_detection_module_struct *ndpi_stru
if(ndpi_match_strprefix(packet->payload, payload_len, "RIFF"))
return 1;
- /* MZ is a .exe file */
- if((packet->payload[0] == 'M') && (packet->payload[1] == 'Z') && (packet->payload[3] == 0x00))
- return 1;
-
/* Ogg files */
if(ndpi_match_strprefix(packet->payload, payload_len, "OggS"))
return 1;
@@ -118,10 +114,6 @@ static int ndpi_match_file_header(struct ndpi_detection_module_struct *ndpi_stru
if((packet->payload[0] == 0x3c) && (packet->payload[1] == 0x3f) && (packet->payload[2] == 0x70) && (packet->payload[3] == 0x68))
return 1;
- /* Unix scripts */
- if((packet->payload[0] == 0x23) && (packet->payload[1] == 0x21) && (packet->payload[2] == 0x2f) && (packet->payload[3] == 0x62))
- return 1;
-
/* PDFs */
if(ndpi_match_strprefix(packet->payload, payload_len, "%PDF"))
return 1;
diff --git a/tests/cfgs/default/pcap/shell.pcap b/tests/cfgs/default/pcap/shell.pcap
new file mode 100644
index 000000000..f542e960e
--- /dev/null
+++ b/tests/cfgs/default/pcap/shell.pcap
Binary files differ
diff --git a/tests/cfgs/default/result/shell.pcap.out b/tests/cfgs/default/result/shell.pcap.out
new file mode 100644
index 000000000..75afae9c5
--- /dev/null
+++ b/tests/cfgs/default/result/shell.pcap.out
@@ -0,0 +1,35 @@
+DPI Packets (TCP): 16 (8.00 pkts/flow)
+DPI Packets (UDP): 2 (1.00 pkts/flow)
+Confidence Unknown : 4 (flows)
+Num dissector calls: 572 (143.00 diss/flow)
+LRU cache ookla: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/12/0 (insert/search/found)
+LRU cache zoom: 0/0/0 (insert/search/found)
+LRU cache stun: 0/0/0 (insert/search/found)
+LRU cache tls_cert: 0/0/0 (insert/search/found)
+LRU cache mining: 0/4/0 (insert/search/found)
+LRU cache msteams: 0/0/0 (insert/search/found)
+LRU cache stun_zoom: 0/2/0 (insert/search/found)
+Automa host: 0/0 (search/found)
+Automa domain: 0/0 (search/found)
+Automa tls cert: 0/0 (search/found)
+Automa risk mask: 0/0 (search/found)
+Automa common alpns: 0/0 (search/found)
+Patricia risk mask: 0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
+Patricia risk: 0/0 (search/found)
+Patricia risk IPv6: 0/0 (search/found)
+Patricia protocols: 8/0 (search/found)
+Patricia protocols IPv6: 0/0 (search/found)
+
+Unknown 18 13422 4
+
+Unrated 18 13422 4
+
+
+
+Undetected flows:
+ 1 TCP 127.0.0.1:54970 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 8][5 pkts/5526 bytes <-> 3 pkts/206 bytes][Goodput ratio: 94/0][1.26 sec][bytes ratio: 0.928 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 315/0 1259/0 545/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1105/69 5254/74 2074/4][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
+ 2 UDP 127.0.0.1:58538 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/5230 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][< 1 sec][Risk: ** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No server to client traffic / Shellscript found][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
+ 3 TCP 127.0.0.1:47638 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 8][4 pkts/1209 bytes <-> 4 pkts/272 bytes][Goodput ratio: 77/0][4.14 sec][bytes ratio: 0.633 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4140/0 1380/0 4140/0 1952/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302/68 1003/74 405/3][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 4 UDP 127.0.0.1:54112 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/979 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No server to client traffic / Shellscript found][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
Powered by cgit, Themed by Ted Yin.